Privacy Policy
This policy explains what WorkMade Technologies, Inc. ("WorkMade", "we", "us") collects about you, why, who we share it with, and the rights you have. We are the controller of your personal data under the UK General Data Protection Regulation and the Data Protection Act 2018.
We do not sell your personal information, and we do not share it for advertising.
1. What we collect
- Contact and account details: name, email address, phone number, postal address and sign-in details.
- Tax identifiers: your National Insurance number and Unique Taxpayer Reference. We collect these only to connect you to HMRC, and we encrypt them at rest. You do not have to give them to us, but without them we cannot connect you to HMRC.
- Information from HMRC: with your authorisation, we retrieve from HMRC's Making Tax Digital services the businesses registered to you, your filing obligations and deadlines, the updates and returns we submit for you, HMRC's tax calculations, and your Self Assessment balance and payment history. We use information from HMRC only to provide the service to you.
- Bank and transaction data: with your consent, account details, balances and transactions from bank accounts you connect through a regulated open banking provider.
- Business records: income, expenses, invoices, receipts and documents you upload, and details of the clients and suppliers you record.
- Chat and voice: if you use our assistant, the messages you send and, for voice, recordings and transcripts. We tell you before recording.
- Device and usage data: IP address, device and browser details, and how you use the service, some of it collected through cookies (see section 10).
- Categorisations and estimates: what we work out from the above, such as how a transaction is categorised and what tax to set aside.
2. Data we send to HMRC about your device
HMRC requires all software that connects to its systems to send information about the device and connection each request comes from, under its fraud prevention rules. When you use WorkMade to interact with HMRC, we send HMRC data such as a device identifier, your public IP address and port, your device's local IP addresses, timezone, screen and window size, browser and operating system details, an identifier for your WorkMade account, and a hashed identifier for your subscription. For requests we make on your behalf without you present, such as a scheduled filing, we send equivalent details about our own server.
HMRC uses this data to detect and prevent fraud against the tax system. We cannot connect you to HMRC without sending it. HMRC explains its use of this data in its own transaction monitoring privacy notice.
3. Why we use your information, and the legal basis
- To provide the service (keeping your books, estimating tax, preparing and submitting what you approve to HMRC, moving money you instruct): performance of our contract with you.
- To meet legal duties, including HMRC's software requirements, tax record-keeping, and fraud prevention: legal obligation.
- To keep the service secure and improve it, and to answer support requests: our legitimate interests, balanced against yours.
- To send you marketing about the UK launch: your consent, which you give when you join the waitlist and can withdraw at any time using the link in every email.
We do not use your identifiable financial, tax or voice data to train artificial intelligence models without your separate consent.
4. Artificial intelligence and automated processing
We use AI to categorise transactions, read documents you upload, draft your quarterly updates and returns, estimate tax, and answer your questions. The AI assists you; it does not make decisions about you on its own. Every submission to HMRC is shown to you first and goes only when you approve it, and you can change any categorisation.
Where automated processing could significantly affect you, you have the right to be told how it works, to give your point of view, to ask for a person to review the outcome, and to contest it. Contact legal@workmade.com.
5. Who we share information with
We share personal data only with providers that help us run the service, under contracts that restrict what they may do with it:
- HMRC, when you authorise us to retrieve information or submit on your behalf.
- Open banking providers (currently Plaid), which are authorised by the Financial Conduct Authority, to connect your bank accounts and initiate payments you instruct.
- Payment processors (currently Stripe) for subscriptions, invoicing and card payments.
- AI providers (currently OpenAI) to power the assistant and document reading.
- Infrastructure and security providers: cloud hosting and storage (Cloudflare, PlanetScale, Amazon Web Services), error monitoring (Sentry), product analytics (PostHog) and customer support (Intercom).
- Professional advisers such as auditors, accountants and lawyers.
- Authorities and courts, where the law requires it or to protect the rights and safety of you, us or others.
- A buyer or successor in a merger, acquisition or sale of assets, subject to this policy.
6. Where your data is stored and international transfers
We are a US company and the service runs in the United States, so your data is stored and processed there. Where we transfer UK personal data to our US providers, we rely on the UK Extension to the EU–US Data Privacy Framework for providers certified under it, and otherwise on the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, together with a transfer risk assessment. Copies of the safeguards we rely on are available on request.
7. How long we keep it
We keep your data for as long as you have an account and as long afterwards as we need it for the purposes above. Records of what we submitted to HMRC on your behalf, and the data behind those submissions, are kept for as long as UK tax law requires, generally six years after the end of the tax year, even if you close your account, so that you and HMRC can rely on them. Voice recordings are kept only as long as needed to operate the feature and then deleted; transcripts form part of your account record. Waitlist data is kept until you unsubscribe or the launch is complete.
8. Security
We protect your information with encryption in transit and at rest, field-level encryption for tax identifiers and bank tokens, access controls, and regular security testing. No system is completely secure. If a breach affects your data, we will tell you and the Information Commissioner's Office as the law requires, and we will report it to HMRC where it involves the HMRC connection.
9. Your rights
Under UK data protection law you can ask us to: give you access to your data; correct it; delete it; restrict or object to how we use it; give you a copy in a portable form; and withdraw consent where we rely on it. You can also object to automated decision-making as described in section 4. You own your records, and you can export them from the service at any time.
To exercise any right, email legal@workmade.com. We will respond within one month, or tell you if we need longer for a complex request. If you are unhappy with our response, you can complain to us and we will acknowledge your complaint within 30 days and reply without undue delay. You also have the right to complain to the Information Commissioner's Office.
10. Cookies and marketing
Our website uses only essential cookies unless you accept more. Advertising and analytics cookies, including the Meta and Google pixels on our waitlist page, are set only if you choose "Accept" on the cookie notice, and you can change your mind at any time. See our cookie policy for details.
We send marketing email only with your consent. Every marketing email includes an unsubscribe link, and we keep a record of your consent. Emails we must send to run your account, such as a confirmation that you joined the waitlist, are not marketing.
11. Children
The service is for adults aged 18 and over. We do not knowingly collect information from anyone under 18.
12. Changes and how to contact us
We will post any changes here with a new effective date, and tell you directly about material changes. If we ever want to use data we already hold for a materially different purpose, we will ask for your consent where the law requires it.
WorkMade Technologies, Inc., 2261 Market Street, Suite 85249, San Francisco, CA 94114, United States · legal@workmade.com
WorkMade is independent software and is not affiliated with, endorsed by, or acting for HM Revenue & Customs. WorkMade Technologies, Inc. is a Delaware corporation. Our terms of service.